AWS S3 Connector creates AWSGuardDuty records but all parsed fields remain empty for native GuardDuty Export Findings

[satheeshkumar5555]

Describe the bug

The Microsoft Sentinel Amazon Web Services S3 connector successfully ingests native AWS GuardDuty Export Findings and creates records in the AWSGuardDuty table.

However, every parsed field remains empty or null.

The connector successfully consumes and deletes SQS messages, the AWSGuardDuty table is populated with new rows, but fields such as SchemaVersion, AccountId, Region, Id, Severity, Title, Description, ResourceDetails and ServiceDetails are all empty.

CloudTrail ingestion using the same AWS account, S3 connector and Sentinel workspace works correctly.

This appears to be either a parser issue or an incompatibility with the current native GuardDuty Export Findings format.

---

Environment

Azure Subscription:

• Azure Free Trial

Microsoft Sentinel:

• Amazon Web Services S3 Connector

AWS:

• GuardDuty Export Findings
• Native AWS Export (no Lambda transformation)

Region:

• Sentinel Workspace: East US
• GuardDuty Detector: eu-central-1

---

Steps to Reproduce

1. Enable AWS GuardDuty Export Findings.
2. Configure export to an S3 bucket using KMS encryption.
3. Configure S3 Event Notification to SQS.
4. Configure Microsoft Sentinel Amazon Web Services S3 connector.
5. Select AWSGuardDuty as the destination table.
6. Generate GuardDuty findings.
7. Wait for Sentinel ingestion.

---

Expected behavior

Rows should be populated with values such as:

• SchemaVersion
• AccountId
• Region
• Id
• Arn
• Severity
• Title
• Description
• ResourceDetails
• ServiceDetails

---

Actual behavior

Rows are inserted into AWSGuardDuty, however every parsed column is empty.

Example:

SchemaVersion = ""
AccountId = ""
Region = ""
Id = ""
Severity = null
Title = ""
Description = ""

Only Sentinel-generated metadata such as TenantId and TimeGenerated are populated.

---

What has already been verified

✅ Native AWS GuardDuty Export Findings (no Lambda)

✅ Native .jsonl.gz files generated by AWS

✅ Dedicated S3 bucket

✅ Dedicated SQS queue

✅ SQS messages are consumed and deleted

✅ IAM permissions verified

✅ KMS permissions verified

✅ OIDC authentication working

✅ AWSGuardDuty table exists

✅ 173 records successfully inserted

✅ AWSCloudTrail ingestion works correctly in the same workspace

✅ SentinelHealth contains no ingestion failures

---

Sample finding

The exported GuardDuty JSON contains the expected fields, for example:

{
"schemaVersion": "2.0",
"accountId": "...",
"region": "...",
"id": "...",
"severity": 2,
"title": "...",
"description": "...",
"resource": { ... },
"service": { ... }
}

---

KQL evidence

The table schema contains all expected GuardDuty columns:

AWSGuardDuty
| getschema

The rows are created, but pack_all() shows empty values:

AWSGuardDuty
| take 1
| extend Packed = pack_all()

Example output:

SchemaVersion = ""
AccountId = ""
Region = ""
Id = ""
Severity = null
Title = ""
Description = ""

---

Additional Information

CloudTrail ingestion using the same connector and workspace parses correctly.

The issue only affects AWSGuardDuty parsing.

I can provide the original native GuardDuty .jsonl.gz export file privately if required for reproduction.